Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Developers Hate Antiviruses

blog.jitbit.com

Post reply on HN
Print view View original

81–87 of 87 posts

Re: Why Developers Hate Antiviruses

#81

Post by freehunter »

politician wrote: post #79
jgmmo wrote: post #62

Earlier quoted context omitted.

Answer: Good definitions are crafted so that are intended to detect not only all existing versions seen but also allows room for change and file characteristic changes so that future versions of the malware family can be caught with the same definition. Good definitions will go on killing items in the wild well past the date the initial zero-day came out (the one that caused the need for the definition in the first p…

Well, ok, that makes sense; I thought the OP was trying to say that AV provides protection against brand new zero-day exploits which seems like wishful thinking.

No, I meant basically what jgmmo said, the AV scanners pick up a lot more than the virus they were written to prevent. Anything that triggers virus-like behavior will let you know you're infected (might not be able to clean it though). That's one of the points made in the article about false positives.

Re: Why Developers Hate Antiviruses

#82

Post by jgmmo »

drucken wrote: post #80
jgmmo wrote: post #63

Earlier quoted context omitted.

The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.

If a mere name alone is enough to create a false positive and changing this is a living nightmare, why are you in the least bit surprised that customers and developers are livid at having to deal or workaround the closed and disparate world of AV? Neither is it the least bit surprising that support personnel and developers consider the shear number and consistency of false positives as "fear-mongering". It would only…

I think it can be justified. It's not common, it's known as being one of the more crude methods of detecting malware -- but hey -- we use what works and what fixes peoples machines. That is why it is in use by some vendors today.

Here's an example:

Some companies block anything named 'svchost.exe' that isn't in system32. Create a txt doc and name it svchost.exe and drop it on your desktop and some antivirus software will detect and remove that item.

Why? Because there is no good reason for someone to have svchost.exe anywhere other than SYSTEM32 and also because svchost.exe is one of the top 10 most common names for malware. So, at risk of some FP's -- some companies have a rule that simply removes these if found anywhere else.

Re: Why Developers Hate Antiviruses

#83

Post by [deleted] »

jconley wrote: post #6

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…

[deleted]

Re: Why Developers Hate Antiviruses

#84

Post by DanBC »

polymatter wrote: post #57
freehunter wrote: post #49

Earlier quoted context omitted.

Until you get hit with a zero-day browser exploit that doesn't need you to install an exe to run.

how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.

Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1])

But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the OS; use a preview pane that auto-opens a lot of things so you don't need to "open" an email message it's been opened for you by the pre-installed email client etc etc) really didn't help.

There's also a problem with users. (This comment in not aimed at you!) Some operating systems have very many users who believe themselves to be clueful but who really really are not. The arrogant 19 year old who can slot together a motherboard and GPU and PSU and put them in a case, who can connect his aunt's computer to the Internet, who can install add-ons to his web browser. These are people who think they know what they're doing, who think that the pirated OS they use is fine because they checked an MD5 hash, and who think the pirated software they use is fine because someone would have said something in the torrent comments if it wasn't. And then, if they have a problem, they'll download a pirate AV and hope that isn't infected. These are the people most mocking of the "wipe and re-install; that's the only safe option" philosophy. They'll spend a day using various bits of anti-malware and scanners and web-searching. And they won't find the infected WMV file and they'll get re-infected a few days later.

[1] (http://blogs.rsa.com/rivner/anatomy-of-an-attack/)

Re: Why Developers Hate Antiviruses

#85

Post by freehunter »

DanBC wrote: post #84
polymatter wrote: post #57

Earlier quoted context omitted.

how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.

Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1]) But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the O…

It drives me crazy when we find an infected computer at work and the solution posited by both the user and the desktop team is "run the corporate AV". No. We have a backup system for a reason. If you don't use it (like the policy mandates you do), that's your fault. The machine gets completely wiped and reimaged.

AVs are a first-line and an indication that something is wrong. If you need to run the AV to clean an actual, real virus, you should be reloading the machine.

Re: Why Developers Hate Antiviruses

#86

Post by pnathan »

jgmmo wrote: post #63
pnathan wrote: post #55

Earlier quoted context omitted.

I did ask my dad to call. Nothing seemed to come of it. I was working in a hurry and didn't think to simply change the exe name, making the presumption that such a simple thing shouldn't influence the AV decision.

The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.

If I'm a 6 foot white guy with blond hair and blue eyes with the name bin Laden, I would expect some funny looks and nothing more.

Names - particalarly short ones - are not what you might call unique identifiers.

It's idiotic to match on names like rte.exe.

Re: Why Developers Hate Antiviruses

#87

Post by jgmmo »

pnathan wrote: post #86
jgmmo wrote: post #63

Earlier quoted context omitted.

The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.

If I'm a 6 foot white guy with blond hair and blue eyes with the name bin Laden, I would expect some funny looks and nothing more. Names - particalarly short ones - are not what you might call unique identifiers. It's idiotic to match on names like rte.exe.

Of course it is. No legit anitvirus company is blocking all files named rte.exe. That's insanity. I am just saying in some circumstances, the name of a file can be a huge help in indicating that maybe you should take a closer look.
Post reply on HN